Hi, I would like to create an external table with an Hive regex expression by selecting lines containing "ARMING" (in uppercase). The records HDFS look like this 2018-06-06T11:28:54+02:00 sazqye named[980]: ARMING trigger on (action:LOG) (T6-Recursive-attacks recursive-time: 1283) 2018-06-06T11:20:27+02:00 sazqyd named[92960]: client (1.debian) ... My request : CREATE EXTERNAL TABLE my_arming_table (
dc_syslog_date STRING,
dc_syslog_hostname STRING,
dc_syslog_process STRING,
dc_logtype STRING, dc_message STRING)
PARTITIONED BY (yearbrut INT, monthbrut INT, daybrut INT) ROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe' WITH SERDEPROPERTIES(
'input.regex'='^(\\S+)\\s(\\S+)\\s(\\S+)\\s(ARMING)\\s(.*)')
STORED AS TEXTFILE; The result is KO : > select * from my_arming_table limit 2 ; OK
NULL NULL NULL NULL NULL 0 0 0 NULL NULL NULL NULL NULL 0 0 0 And if I try this request (with client in lowercase) CREATE EXTERNAL TABLE my_client_table (
dc_syslog_date STRING,
dc_syslog_hostname STRING,
dc_syslog_process STRING,
dc_logtype STRING,
dc_message STRING)
PARTITIONED BY (yearbrut INT, monthbrut INT, daybrut INT) ROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe' WITH SERDEPROPERTIES(
'input.regex'='^(\\S+)\\s(\\S+)\\s(\\S+)\\s(client)\\s(.*)')
STORED AS TEXTFILE; The result is OK > select * from my_client_table limit 2 ;
OK
2018-06-06T11:12:55+02:00 sazqyd named[92960]: client (swza6z) 0 0 0 2018-06-06T11:13:10+02:00 sazqyd named[92960]: client (osce01) 0 0 0 Does anybody knows why it doesn't work with uppercase in the regex expression ? Thanks
... View more
